2

The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string.

The strings are in the binary file analyzed by IDA, but since there isn't any segment for them, IDA ignored them.

I tried manually creating the segment, which works (it now references unknown variables instead of memory addreses), but I can't figure out how to load the proper data into that section. (The entire section is filed with db ? ;)

I've tried using File > Load File > Load additional binary file(with file offset & size), as well as reloading the current file. I've also dumped the part of the file I'm interested in another file and tried to load that one as an additional binary as well.

The only results I can get from that is:

  • IDA creates a new segment at the end of all other segments (Not following the Loading Segment address I filled in.
  • If I uncheck Create Segments, IDA does nothing. (Even though I specified the address of my manually created segment in Loading Segment

The segment I manually created has the following settings: segment settings .

Here's the form I filled while loading the binary file that contains the data I want. load binary file settings .

I've never done this before, so it's likely I'm doing something wrong, but I can't figure it out.

Improve this question
4
  • Did you try manual load option when loading the file in IDA?
    – bart1e
    Aug 17, 2019 at 18:42
  • No - it's a big file that IDA already analyzed (I've noticed the missing strings later on). I'd like to avoid having to re-analyze it if possible.
    – Hx0
    Aug 17, 2019 at 18:44
  • If I'm not mistaken db ? in IDA means the data is not initialised (usually present in .bss section). Why did you give that segment execute permission if it only contains strings? I would also uncheck Code segment field when loading the additional binary file.
    – bart1e
    Aug 17, 2019 at 18:52
  • I've removed the execute permission. I've tried unchecking Code segment, but IDA still doesn't do anything when loading the binary file.
    – Hx0
    Aug 17, 2019 at 18:58

1 Answer 1

Reset to default
2

Use the menu: File -> Load file -> Additional binary file, and then simply enter the segment address you want.
The reason you fail on this operation is because you are misunderstanding the "segment" in IDA.
In IDA the segment is defined by (selector, base) and offset. The final address is calculated by
(base << 4) + offset.
In fact, IDA is telling you to input "in paragraph", which is 0x10 each paragraph on IBM PC.
But as x86 is using "flat memory model" now, what you should use is something like this: enter image description here Your original operation will create a segment which has an EA of 0x1431A20000 (note the last zero), and what you will see in the IDA view will be segXXX:XXXXX instead of the "flat" segments like .text

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.